Browse Source

make a proper readme

master
forest 2 years ago
parent
commit
033fa38840
  1. 19
      ReadMe.md
  2. 15
      notes.txt

19
ReadMe.md

@ -2,12 +2,21 @@
server.garden Privileged Automation Agent
### notes
Rootsystem is the entrypoint & most highly priveleged part of the server.garden automation system, hence "root" in the name.
Ideally we could use TLS on the connection between terraform and rootsystem.
Rootsystem starts the first time a server.garden system boots, and it uses provided credentials and options to create, plan & apply multiple terraform projects based on its own collection of terraform modules & ansible roles. It is responsible for installing and configuring the required base-system components of a server.garden datacenter, such as:
Currently this backend only has two options, either use a public x.509 trust based TLS cert, or skip cert verification. We want to use TLS for improved security, but we also want to do it all on the private network without having a domain name or asking for permission.
- [threshold](https://git.sequentialread.com/forest/threshold), the public-internet-facing gateway & TCP reverse tunnel
- [serviceroad](https://git.sequentialread.com/forest/serviceroad), the peer-to-peer vpn
- [spigot](https://git.sequentialread.com/forest/spigot), the consensus & leader-election service
- [caddy](https://caddyserver.com/v2), the Let's Encrypt ACME client, TLS terminator & reverse-proxy
So we will have to modify terraform to add a new "Trusted CAs" option here: https://github.com/hashicorp/terraform/blob/master/backend/remote-state/http/backend.go
Rootsystem will create one `terraform-global` project first, where it configures a DNS entries and/or a cloud instance to act as an ingress gateway.
That way we can make our own CA, our own certificate, and then tell terraform to trust that CA. Then terraform can connect to our HTTP server securely for remote state storage.
Then, it will create a `terraform-local-<node-name>` project on each node, which will set up node-specific elements of the system, both in the cloud (node-specific DNS entries, threshold configurations, etc) and locally on the node itself.
In the future, rootsystem will also have a Continuous-Integration-Ish role, where it handles configuration changes as they are posted & re-runs builds as needed.
Rootsystem has no user-interface of its own, however, it is tightly coupled to the [seedpacket](https://git.sequentialread.com/forest/seedpacket) desktop application. Rootsystem posts status updates to object storage, which seedpacket can read & display to the user in real time via polling.

15
notes.txt

@ -2,4 +2,17 @@
TODO:
Clean up post_to_object_storage_shell_script. Make it a template rather than a variable?
Clean up absolute path on ssh_public_keys variable?
defense in depth local tls tin foil hat stuff:
Ideally we could use TLS on the connection between terraform and rootsystem.
Currently this backend only has two options, either use a public x.509 trust based TLS cert, or skip cert verification. We want to use TLS for improved security, but we also want to do it all on the private network without having a domain name or asking for permission.
So we will have to modify terraform to add a new "Trusted CAs" option here: https://github.com/hashicorp/terraform/blob/master/backend/remote-state/http/backend.go
That way we can make our own CA, our own certificate, and then tell terraform to trust that CA. Then terraform can connect to our HTTP server securely for remote state storage.

Loading…
Cancel
Save